We test our black-box adversarial attack framework on two deep learning models, namely graph convolutional gated recurrent neural network (GCGRNN) [1]} and diffusion convolutional recurrent neural Network (DCRNN) [2]}, which correspond to state of the art performance on network-wide, multi-step traffic state prediction. In comparison, we also test two traditional methods, namely linear regression and historical average. Using substitute models trained on the hourly traffic flow data from the Caltrans Performance Measurement System (PeMS) [3]}, we show that the adversary can degrade the performance of GCGRNN up to \(26.41\%\)  and DCRNN up to \(54.07\%\) . Compared to deep learning models, traditional models are robust against adversarial attacks with less than \(3\%\)  or no performance degradation.
